nicweyand
9705b01fe4
All checks were successful
Standalone registry checks / check (push) Successful in 3m47s
73 lines
4.3 KiB
Markdown
73 lines
4.3 KiB
Markdown
# Trust and evidence policy
|
|
|
|
## What the implementation enforces
|
|
|
|
Inputs use reviewed source adapters and explicit manifests. URL normalization,
|
|
PSL parsing and stable identities are deterministic. Fact provenance, conflicting
|
|
evidence and source-specific popularity remain separate. Names and similar
|
|
hostnames never silently join entities. Invalid URLs and malformed imports fail
|
|
validation; a partial import does not replace a complete source selection.
|
|
|
|
Destination and identity decisions bind exact evidence fingerprints, including
|
|
names, assertions and normalization context. Reviews expire within 90 days.
|
|
Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity,
|
|
ties, missing approval or ineligible claims; regional scopes must explicitly
|
|
match. Reviewer decisions are signed under a dedicated SSH namespace and the local
|
|
writer retains their exact decision/signature bytes in the append-only review log.
|
|
|
|
Generations bind the database, license document and attribution to a completion
|
|
receipt. Consumers provide a trusted hash or verify an external publisher key.
|
|
Release signing re-verifies every stored decision against an external reviewer
|
|
trust file. Activation checks publisher signatures, re-verifies every review
|
|
against a separately supplied reviewer trust file and refuses rollback that loses
|
|
distributed revocations. Reviewer validity epochs are evaluated at decision time
|
|
for retained history while new decisions must pass the trust policy at append
|
|
time. Updates build candidates and cannot approve, sign or activate them.
|
|
|
|
## What a publisher must establish
|
|
|
|
The reviewer name and evidence locator in a decision are operator assertions.
|
|
The CLI authenticates exact decision bytes to an allowed SSH signer and validates
|
|
their structure and evidence binding; it does not retrieve the cited evidence or
|
|
prove website ownership.
|
|
Protect the writer database and signing key with separate operating permissions.
|
|
Restrict who can author decisions and require human review before release signing.
|
|
|
|
Publish dated evidence supporting the exact entity, URL, relationship, role and
|
|
country/locale. Prefer independently corroborated primary evidence with immutable
|
|
capture identifiers. Record contrary evidence and uncertainty. TLS, DNS control,
|
|
registrable-domain spelling, redirects, `sameAs` or popularity alone cannot
|
|
establish every identity or role claim. Future crawler observations remain inputs
|
|
to review. Confidence values are assertion scores, not calibrated probabilities.
|
|
|
|
Choose expiry based on volatility, within the enforced maximum. Do not renew
|
|
blindly on a timer. Expired approval should lead to abstention until evidence is
|
|
reviewed. Disclose editorial conflicts and use an independent reviewer for a
|
|
disputed claim when possible. The implementation is a local single-writer tool
|
|
with externally authenticated reviewer keys; it does not provide accounts or an
|
|
enforced quorum.
|
|
|
|
## What consumers must preserve
|
|
|
|
Authenticate a release before opening it. Consumers that rely on reviewer
|
|
separation must use `release::verify_signed` or `activate` with independently
|
|
distributed publisher and reviewer trust files; a receipt pin alone delegates the
|
|
whole release decision to whoever distributed that pin. Keep the full receipt pin
|
|
and required attribution with caches and exports. Use `resolve` for reviewed destinations, keep
|
|
null as abstention, and enforce application-specific malware/content/navigation
|
|
policy separately. A verified signature authenticates the publisher, not the truth
|
|
of every assertion. An official website may later be compromised.
|
|
|
|
Deliver revocations to every active consumer and derived catalogue, and bound cache
|
|
lifetimes. The resolver checks review expiry at query time; a detached cached URL
|
|
does not recheck itself. Preserve the current review history during rollback.
|
|
Copying SQLite rows or the JSONL export into a second resolver can bypass these
|
|
checks; use the native API or CLI for admission decisions.
|
|
|
|
## Community changes
|
|
|
|
Treat public submissions as untrusted evidence. Do not execute submitted content
|
|
or copy review decisions into production automatically. Source allowlist and
|
|
attribution changes need both implementation tests and documented rights review.
|
|
Reject unknown sources until those checks are complete. Every publisher may apply
|
|
stricter admission rules, and must state its actual review and incident procedures.
|